Trojan.Win32.Shutdowner.etd

Technical Details
Payload
Removal instructions

Technical Details

This Trojan delivers a malicious payload to the user's computer. It is a Windows application (PE EXE file). It is 39 078 bytes in size. It is written in C++.

Payload

Once launched, the Trojan uses the function "GetSystemDefaultLCID" to obtain the ID for the group of national settings that the operating system uses by default. If the value obtained corresponds with:

Russian (ru)
Uzbek (uz)
Ukrainian (uk)
Azeri (az)
Kyrgyz (ky)
Tatar (tt)
Belarusian (be)
Kazakh (kk)
Bashkir (ba)
Divehi (dv)
Yakut (sah)
Armenian (hy)

the Trojan ceases running. The original Trojan file will then be deleted.

Otherwise, the Trojan performs the following actions:

• To ensure that its process is unique within the system, it creates a unique identifier:

  Setup555

• It encrypts the content of its original file, placing it in the file:

  %USERPROFILE%\Local Settings\Application Data\
  Windows Server\server.dat
  

  The original Trojan file is then deleted.
• It extracts the following files from its body:

  %USERPROFILE%\Local Settings\Application Data\
  Windows Server\admin.txt (2 bytes)
  
  %USERPROFILE%\Local Settings\Application Data\
  Windows Server\sphlp.dll 
  

  (2560 bytes; detected by Kaspersky Anti-Virus as "Trojan.Win32.Shutdowner.fhx")
• It creates the following system registry key:

  [HKLM\System\CurrentControlSet\Services\sr\Parameters]
  "FirstRun" = "1"
  

• It deletes the following system registry key:

  [HKLM\Software\Microsoft\Windows NT\CurrentVersion\
  SystemRestore]
  "DisableSR"
  

• It launches the Print Manager's "spooler" service. The Trojan uses this service's procedures to evade behavioral protection. By calling the API function "AddPrintProvidorA", the Trojan launches the code from the previously extracted library "sphlp.dll" in the context of the trusted process "spoolsv.exe".

The library "sphlp.dll" decrypts the content of the file:

%USERPROFILE%\Local Settings\Application Data\
Windows Server\server.dat

and injects the obtained code into the address space of the processes:

iexplore.exe
opera.exe
firefox.exe

The injected code enables it to track user statistics and search requests sent to the following search resources:

altavista.com
google.com
bing.com
yahoo.com

The collected information is saved to the following file:

%System%\hlp.dat

Removal instructions

If your computer does not have an antivirus, and is infected by this malicious program, follow the instructions below to delete it:

1. Terminate the "Spooler" print service.
2. Use Task Manager to terminate the process "spoolsv.exe".
3. Delete the following files:

   %USERPROFILE%\Local Settings\Application Data\
   Windows Server\server.dat
   %USERPROFILE%\Local Settings\Application Data\
   Windows Server\admin.txt 
   %USERPROFILE%\Local Settings\Application Data\
   Windows Server\sphlp.dll 
   %System%\hlp.dat
   

4. Delete the following system registry key (see What is a system registry and how do I use it?):

   [HKLM\System\CurrentControlSet\Services\sr\Parameters]
   "FirstRun" = "1"
   

5. Perform a full scan of the computer using Kaspersky Anti-Virus with up-to-date antivirus databases (download a trial version).